[flintsilver7]

A comment? Wow, consider me "hoist on my own petard." (Verb tense agreement, your mortal enemy, would appear to have hoisted you on your own petard.)

I am not (nor have I ever) argued that there is a plethora of OSX-specific malware out there. I take issue with the idea that security through obscurity is in fact any security at all. This applies to Unix in general as well. If malware exists, either as proof of concept or otherwise, then a security vulnerability exists. If an application-level vulnerability exists (such as those in Safari that allow Macs to be given away at CanSecWest), then by definition a security vulnerability exists. If Apple patches security vulnerabilities, then again by definition security vulnerabilities exist. This argument is completely idiotic - it's like saying that because you've never gotten into an accident in your car then it's accident-proof.

By the way, cross-platform malware has increased substantially and will continue to do so as the heterogeneity of the computing market increases.

[RegulatorCountry]

(Verb tense agreement, your mortal enemy, would appear to have hoisted you on your own petard.)

It's always a good thing to understand what you're attempting to correct before doing so, lol. You clearly don't.

[dayglored]

> (Verb tense agreement, your mortal enemy, would appear to have hoisted you on your own petard.)

Nope, sorry. 10 points deducted for ignorance of the classics, to wit, Shakespeare's Hamlet:

Let it work;
For 'tis the sport to have the enginer
Hoist with his own petar; and 't shall go hard...

Swordmaker's use of the phrase is an obvious reference to the original.

I must say, however, that other than this bit of unintentional humor, the exchange is getting a bit long in the tooth.

[Swordmaker]

I take issue with the idea that security through obscurity is in fact any security at all. This applies to Unix in general as well. If malware exists, either as proof of concept or otherwise, then a security vulnerability exists.

As do we, having shot that canard down many times. And, a FAILED, proof of concept is no proof... The concept failed so it is no proof. Had the concept worked, then we would be seeing exploits based on the concept. They were attempts to find viable vectors to spread self-replicating, self-installing, self-transmitting malware on OSX Macs. They all failed. Ergo, although they are called "proof-of-concept" if the concept proof fails it proves nothing except they have to go back to the drawing board.

By the way, cross-platform malware has increased substantially and will continue to do so as the heterogeneity of the computing market increases.

When we start seeing it, not theoretical, then we'll worry. Not before. We've been hearing the same litany for ten years. By not listening, we've saved a lot of aggravation and money.

[antiRepublicrat]

I take issue with the idea that security through obscurity is in fact any security at all.

I take issue with anyone who throws that canard out without knowing all the nuances. Security through obscurity can be useful, as one more stumbling block to break a system, slowing down attackers, or for raising the bar for the talent necessary to break the system. It isn't something to be absolutely relied on in the end, but its use is not automatically invalid.

The argument that the number of installations is smaller creates security through obscurity is invalid here. 50 million vs. install bases as small as about 100 that have been targeted by malware. Apple is the third most valuable brand in the world, even ahead of Microsoft. Their operating systems (OS X and its brother iOS) run almost everything behind that brand. That's not obscure.

[Swordmaker]

A comment? Wow, consider me "hoist on my own petard." (Verb tense agreement, your mortal enemy, would appear to have hoisted you on your own petard.)

Yes. And you've done it again. You are correcting William Shakespeare. Hamelet, scene three, to be precise. And, Flintsilver? "Hoist" IS the past tense of the verb "hoise," meaning "to lift." if you add "Ed" to it you make it doubly past tense, an oxymoron.

I suspect you don't even know what a petard is. Don't bother rushing to look it up. It's a a large open bore mortar used at close quarter by pressing it against a wall or gate, usually without a projectile, to blow a hole through the fortification.

As you may be getting an inkling, my usage was absolutely correct.